Managed IT and cyber security for regulated firms in London
Managed IT and cyber security for regulated firms in London
The FCA has no separate cyber rulebook. Its expectations come from the duty to have adequate systems and controls (Principle 3 and SYSC), to be open with the regulator (Principle 11), to manage outsourcing (SYSC 8) and, for larger firms, operational resilience (SYSC 15A). In practice that means proportionate security controls, oversight of your IT providers, a tested incident plan and prompt reporting. From 18 March 2027, PS26/2 sets out a standard way to report operational incidents, including cyber attacks, normally within 24 hours of deciding an incident meets the threshold.
Search for an FCA cyber security rulebook and you will not find one. The FCA regulates cyber risk through rules that apply to all operational risk, so the obligations are spread across a few parts of the Handbook:
On top of FCA rules, UK GDPR applies to the personal data you hold, and the Consumer Duty expects you to avoid foreseeable harm to retail customers, which includes harm from fraud and data loss that weak security makes possible.
The FCA judges controls against your size and risk, so an adviser with ten staff is not expected to run a security operations centre. It is expected to have the basics done well and to be able to show it. These are the controls a supervisor, auditor or insurer will usually ask about first:
| Control | What good looks like | Evidence worth keeping |
|---|---|---|
| Identity | Multi-factor authentication on email, Microsoft 365, platforms and remote access, with no forgotten exceptions. | MFA coverage report, list of approved exceptions with an owner and review date. |
| Devices | Company devices managed centrally, encrypted, patched within 14 days for critical fixes, with endpoint protection. | Device compliance and patch reports. |
| Filtering, DMARC, SPF and DKIM configured, and external email clearly marked. | DMARC report, mail filtering settings. | |
| Access | Least privilege, separate admin accounts, leavers removed the same day, access reviewed at least every quarter. | Access review records, joiner and leaver logs. |
| Backup | Backups of Microsoft 365 and key systems kept separately from the live environment, with restores tested. | Backup reports and restore test records. |
| People | Regular phishing awareness training and a clear rule for verifying payment and bank detail changes. | Training completion and phishing simulation results. |
| Response | A written incident plan that names who decides, who reports and who to call, exercised at least once a year. | Plan, exercise notes, actions closed. |
Cyber Essentials is a sensible way to prove the first five rows to an independent assessor. Our Cyber Essentials guide covers what changed in 2026.
The FCA published PS26/2, Operational incident and third party reporting, on 18 March 2026. The rules apply from 18 March 2027 and cover every firm with a Part 4A permission, payment service providers and some market infrastructure. A cyber attack is one of the most likely triggers.
The 24-hour clock starts when you make the decision, not when the attack began, but the FCA will expect that decision to be made promptly. That makes two things essential before 2027: a named person who can make the call quickly, and an IT provider contractually obliged to tell you about incidents straight away.
PS26/2 also requires certain firms, including enhanced-scope SM&CR firms, banks, building societies, insurers and authorised payment and e-money institutions, to identify their material third-party arrangements, notify the FCA before becoming contractually or operationally committed to a new or materially changed one, and submit a register every year.
Even if those notification rules do not apply to you, SYSC 8 does in substance: you must do due diligence before appointing an IT or cyber security provider, agree contract terms covering security, access, audit, incident notification and exit, and keep supervising them. Our guide to IT vendor and outsourcing management sets out a proportionate approach.
A related change is on the way. The Cyber Security and Resilience Bill, which was before the House of Lords in autumn 2026, is expected to bring many managed service providers into the UK’s network and information systems regime, with their own duties to report significant incidents. That will raise the bar for providers, but it does not reduce your own obligations to the FCA.
The FCA points firms to a few tools on its cyber resilience page. CQUEST is a 50-question cyber resilience self-assessment developed with the PRA, and ORQUEST covers wider operational resilience; both are available through your supervisor. Larger, systemically important firms may be asked to take part in CBEST threat-led penetration testing, and the FCA publishes themes from those tests and from its Cyber Coordination Groups. Smaller firms can use these themes as a free checklist of what regulators are seeing.
If you are not sure where your firm stands, a practical order of work is:
Our cyber incident playbook covers who to notify, and when, if the worst happens.